@owlmeans/api-config-server 0.1.18-rc.17 → 0.1.18-rc.18

package/README.md

@@ -4,7 +4,7 @@ Server-side entrypoint that serves safe configuration values at `GET /assets/con
 
 ## Overview
 
-- Registers the `API_CONFIG` handler that returns non-sensitive config fields to clients
+- Registers the `API_CONFIG` handler that returns package-allowlisted config fields to clients
 - Used alongside `@owlmeans/api-config-client` to push runtime config from server to browser
 - Include `entrypoints` in your server entrypoint registration
 
@@ -28,6 +28,8 @@ context.registerEntrypoints([...appEntrypoints, ...apiConfigEntrypoints])
 ### `entrypoints`
 
 Array of server-side route handlers for the config advertisement endpoint (`GET /assets/config.json`).
+The handler returns only values registered through `apiConfigPlugin()` by packages loaded in the
+server process; it never copies server config generically.
 
 ## Related Packages
 
@@ -42,7 +44,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.12
+npx @owlmeans/agent-skills@^0.1.18-rc.13
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/api-config-server",
-  "version": "0.1.18-rc.17",
-  "generatedAt": "2026-09-04T22:43:25.439Z",
+  "version": "0.1.18-rc.18",
+  "generatedAt": "2026-09-10T18:54:42.492Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/api-config-server/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-config-server
-description: How to use @owlmeans/api-config-server — the backend half of the runtime config flow, which answers the api-config endpoint with a redacted copy of the server config. Auto-invoked when serving API config from a server app or deciding what a backend advertises to its clients.
+description: How to use @owlmeans/api-config-server — the backend half of the runtime config flow, which answers the api-config endpoint from package-owned allowlist plugins. Auto-invoked when serving API config from a server app or deciding what a backend advertises to its clients.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/api-config-server
 
 **Layer:** Server
-**Install:** `"@owlmeans/api-config-server": "^0.1.18-rc.17"` in `dependencies`
+**Install:** `"@owlmeans/api-config-server": "^0.1.18-rc.18"` in `dependencies`
 
 Answers the declaration shared by `@owlmeans/api-config`; the browser side that consumes it is
 `@owlmeans/api-config-client`.
@@ -31,30 +31,17 @@ include this one, so spreading those is enough and adding this list again is red
 
 ## What is advertised
 
-The handler answers with the server's own config, minus everything the shared redaction lists name:
-
-- `debug` is always present (`{}` when the server sets none).
-- `services` is reduced to `service`, `type`, `host`, `port` and `base` per entry. `internalHost`
-  and `internalPort` are dropped as **keys**, which is not the same as keeping the address private:
-  `sservice` mirrors them into `host` / `port` whenever those are unset, so a service declared with
-  the cluster address only advertises the cluster address under a different name. A peer whose
-  address must not be public needs its own public `host` / `port`.
-- `plugins` keeps only the entries whose `type` is `AppType.Frontend`.
-- Config records (`records`) keep only those whose `recordType` is in `allowedConfigRecords`.
-- `oidc`, when configured, is rebuilt rather than copied: `clientCookie` plus the providers with
-  `secret` and `apiClientId` stripped, and providers marked `internal` dropped entirely.
-- Every remaining config key is copied verbatim, except `debug`, `services`, `plugins` and the keys
-  in `notAdvertizedConfigKeys` (`dbs`, `trusted`, `ready`, `service`, `type`, `records`,
-  `webService`, `oidc`, `storageBuckets`, `secrets`). The answer is assembled in three layers — the
-  seeded keys above, then that verbatim copy, then the conditional `oidc` rebuild — so the verbatim
-  copy overwrites whichever seeded key it also carries. `brand` is on neither exclusion list, so it
-  is carried, and the server's own brand settings are what the client receives; the `{}` the handler
-  seeds survives only for a server that declares no brand at all.
-
-The consequence is the rule to work by: **a backend config key is public unless a list says
-otherwise.** Adding a credential, a connection string or an internal address to the config means
-adding its key to `notAdvertizedConfigKeys` in `@owlmeans/api-config` in the same change; adding a
-config-record type means listing it in `allowedConfigRecords` before a client can see it.
+The handler calls `advertisedConfig(ctx.cfg)`. It copies nothing generically: only import-time
+`apiConfigPlugin()` registrations from `@owlmeans/api-config` and packages the application loaded
+can contribute fields.
+
+- Base registration keeps public service routes, branding, login settings, selected debug flags and frontend plugins. An `sservice()` route with only `internalHost`/`internalPort` is omitted rather than re-exposed through its derived `host`/`port`.
+- `@owlmeans/oidc` admits only browser OIDC fields and drops internal providers and credentials.
+- `@owlmeans/flow`, `@owlmeans/i18n` and `@owlmeans/payment` register their own client settings and record types.
+- SMTP, queues, databases, storage, trusted keys, secrets and all unregistered config fields are absent.
+
+The endpoint carries no guard — it is fetched before the client has any credential — so nothing
+that requires authorization to read belongs in a plugin's `allow` selection.
 
 The endpoint carries no guard — it is fetched before the client has any credential — so nothing
 that requires authorization to read belongs in the answer.

package/build/actions/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AASrD,eAAO,MAAM,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAuCtD,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIrD,eAAO,MAAM,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAEtD,CAAA"}

package/build/actions/config.js

@@ -1,34 +1,6 @@
-import { notAdvertizedConfigKeys, allowedConfigRecords } from '@owlmeans/api-config';
+import { advertisedConfig } from '@owlmeans/api-config';
 import { handleRequest } from '@owlmeans/server-api';
-import { PLUGINS } from '@owlmeans/config';
-import { AppType, CONFIG_RECORD } from '@owlmeans/context';
 export const advertise = handleRequest(async (_, ctx) => {
-    const apiConfig = {
-        debug: ctx.cfg.debug ?? {},
-        brand: {},
-        services: Object.fromEntries(Object.entries(ctx.cfg.services ?? {}).map(([service, config]) => [
-            service, {
-                service: config.service,
-                type: config.type,
-                host: config.host,
-                port: config.port,
-                base: config.base
-            }
-        ])),
-        plugins: (ctx.cfg[PLUGINS] ?? [])
-            .filter((plugin) => plugin.type === AppType.Frontend),
-        [CONFIG_RECORD]: (ctx.cfg[CONFIG_RECORD] ?? []).filter((record) => record.recordType != null && allowedConfigRecords.includes(record.recordType)),
-        ...(Object.fromEntries(Object.entries(ctx.cfg).filter(([key]) => ![
-            'debug', 'services', PLUGINS, ...notAdvertizedConfigKeys
-        ].includes(key)))),
-        ...("oidc" in ctx.cfg ? {
-            oidc: {
-                clientCookie: ctx.cfg.oidc.clientCookie,
-                providers: ctx.cfg.oidc.providers?.map(provider => Object.fromEntries(Object.entries(provider)
-                    .filter(([key]) => !['secret', 'apiClientId'].includes(key)))).filter(provider => provider.internal !== true),
-            }
-        } : {})
-    };
-    return apiConfig;
+    return advertisedConfig(ctx.cfg);
 });
 //# sourceMappingURL=config.js.map

package/build/actions/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAG1D,MAAM,CAAC,MAAM,SAAS,GAAsC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;IACzF,MAAM,SAAS,GAAc;QAC3B,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAChF,OAAO,EAAE;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF,CAAC,CACH;QACD,OAAO,EAAE,CAAE,GAAG,CAAC,GAAiD,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;aAC7E,MAAM,CAAC,CAAC,MAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC;QACrE,CAAC,aAAa,CAAC,EAAE,CAAE,GAAG,CAAC,GAAiD,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACnG,CAAC,MAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CACxG;QACD,GAAG,CACD,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,uBAAuB;SACzD,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACjB,CACF;QACD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE;gBACJ,YAAY,EAAG,GAAG,CAAC,GAAG,CAAC,IAAkC,CAAC,YAAY;gBACtE,SAAS,EAAG,GAAG,CAAC,GAAG,CAAC,IAAgC,CAAC,SAAS,EAAE,GAAG,CACjE,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;qBACpD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAChE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;aACjD;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,OAAO,SAAS,CAAA;AAClB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,CAAC,MAAM,SAAS,GAAsC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;IACzF,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAc,CAAA;AAC/C,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/api-config-server",
-  "version": "0.1.18-rc.17",
+  "version": "0.1.18-rc.18",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,10 +21,10 @@
     }
   },
   "dependencies": {
-    "@owlmeans/api-config": "^0.1.18-rc.12",
-    "@owlmeans/server-api": "^0.1.18-rc.17",
-    "@owlmeans/server-context": "^0.1.18-rc.12",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.11"
+    "@owlmeans/api-config": "^0.1.18-rc.13",
+    "@owlmeans/server-api": "^0.1.18-rc.18",
+    "@owlmeans/server-context": "^0.1.18-rc.13",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.12"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/actions/config.ts

@@ -1,50 +1,8 @@
 import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 import type { ApiConfig } from '@owlmeans/api-config'
-import type { ServerConfig } from '@owlmeans/server-context'
-import type { PluginConfig } from '@owlmeans/config'
-import { notAdvertizedConfigKeys, allowedConfigRecords } from '@owlmeans/api-config'
+import { advertisedConfig } from '@owlmeans/api-config'
 import { handleRequest } from '@owlmeans/server-api'
-import { PLUGINS } from '@owlmeans/config'
-import { AppType, CONFIG_RECORD } from '@owlmeans/context'
-import type { ConfigRecord } from '@owlmeans/context'
 
 export const advertise: RefedEntrypointHandler<ApiConfig> = handleRequest(async (_, ctx) => {
-  const apiConfig: ApiConfig = {
-    debug: ctx.cfg.debug ?? {},
-    brand: {},
-    services: Object.fromEntries(
-      Object.entries(ctx.cfg.services ?? {} as ServerConfig).map(([service, config]) => [
-        service, {
-          service: config.service,
-          type: config.type,
-          host: config.host,
-          port: config.port,
-          base: config.base
-        }
-      ])
-    ),
-    plugins: ((ctx.cfg as unknown as Record<string, PluginConfig[]>)[PLUGINS] ?? [])
-      .filter((plugin: PluginConfig) => plugin.type === AppType.Frontend),
-    [CONFIG_RECORD]: ((ctx.cfg as unknown as Record<string, ConfigRecord[]>)[CONFIG_RECORD] ?? []).filter(
-      (record: ConfigRecord) => record.recordType != null && allowedConfigRecords.includes(record.recordType)
-    ),
-    ...(
-      Object.fromEntries(
-        Object.entries(ctx.cfg).filter(([key]) => ![
-          'debug', 'services', PLUGINS, ...notAdvertizedConfigKeys
-        ].includes(key))
-      )
-    ),
-    ...("oidc" in ctx.cfg ? {
-      oidc: {
-        clientCookie: (ctx.cfg.oidc as { clientCookie: unknown }).clientCookie,
-        providers: (ctx.cfg.oidc as { providers: Object[] }).providers?.map(
-          provider => Object.fromEntries(Object.entries(provider)
-            .filter(([key]) => !['secret', 'apiClientId'].includes(key)))
-        ).filter(provider => provider.internal !== true),
-      }
-    } : {})
-  }
-
-  return apiConfig
+  return advertisedConfig(ctx.cfg) as ApiConfig
 })